Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8027-1 advisory.

    It was discovered that Python-Multipart incorrectly handled certain

    regular expressions. An attacker could possibly use this issue to cause Python-Multipart to consume     excessive resources, leading to a regular

    expression denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24762)

    It was discovered that Python-Multipart did not properly sanitize line breaks during user input. An     attacker could use this issue to send

    arbitrary input, thus preventing other requests from being processed,

    resulting in a denial of service. This issue was only fixed in

    Ubuntu 24.04 LTS. (CVE-2024-53981)

    It was discovered that Python-Multipart was vulnerable to path traversal attacks. An attacker could     possibly craft and upload files outside the

    target directory, resulting in remote code execution. (CVE-2026-24486)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-08c12edc84 advisory.

    Security fix for [CVE-2026-24486](https://www.cve.org/CVERecord?id=CVE-2026-24486) / [GHSA-     wp53-j4wj-2cfg](https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg).

    ----

    ## 0.0.22 (2026-01-25)

    * Drop directory path from filename in `File`


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-720b8d0c6c advisory.

    Security fix for [CVE-2026-24486](https://www.cve.org/CVERecord?id=CVE-2026-24486) / [GHSA-     wp53-j4wj-2cfg](https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg).

    ----

    ## 0.0.22 (2026-01-25)

    * Drop directory path from filename in `File`


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0307-1 advisory.

    - CVE-2026-24486: Fixed non-default configuration options can lead to path traversal (bsc#1257301).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal     vulnerability exists when using non-default configuration options `UPLOAD_DIR` and     `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem     by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a     workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations. (CVE-2026-24486)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298807	Ubuntu 22.04 LTS / 24.04 LTS : Python-Multipart vulnerabilities (USN-8027-1)	Nessus	Ubuntu Local Security Checks	high
297761	Fedora 43 : python-python-multipart (2026-08c12edc84)	Nessus	Fedora Local Security Checks	high
297760	Fedora 42 : python-python-multipart (2026-720b8d0c6c)	Nessus	Fedora Local Security Checks	high
297085	openSUSE 15 Security Update : python-python-multipart (SUSE-SU-2026:0307-1)	Nessus	SuSE Local Security Checks	high
296740	Linux Distros Unpatched Vulnerability : CVE-2026-24486	Nessus	Misc.	high

Detections

Analytics

CVE-2026-24486

high

Tenable Plugins

high

high

high

high

high